Yubico and Microsoft Introduce Passwordless Login

Post by sp332 » Tue, May 08, 2018, 7:15 PM UTC

sametmax wrote: post #25

sp332 wrote: post #16

Earlier quoted context omitted.

That is confirmed in the "How does this work?" section. Your concern is addressed in the "Why is this important?" section. The key is definitely more secure against cracking than a password. It is more vulnerable to being physically stolen, but for most people, that is a lower risk.

I doubt that. Friends or family can't read your mind, but they can steal your physical key. People putting pins on their phones or password on their laptop are not afraid of being pirated. This is a vague, abstract threat to them. Becoming part of a botnet is really not important to them, and they getting their credit card stolen from the web is really not credible enough for non tech saavy user. What they are afraid…

Post by e1ven » Tue, May 08, 2018, 7:16 PM UTC

d4l3k wrote: post #26

pishpash wrote: post #23

Earlier quoted context omitted.

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.

Post by GordonS » Tue, May 08, 2018, 7:21 PM UTC

BartBoch wrote: post #20

pg_bot wrote: post #15

Earlier quoted context omitted.

There is the "nano" version available which is a lot smaller than the one advertised. The ones that I own have held up just fine for the past year on my keychain. https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...

This size is much better, but I assume it lacks the "touch" protection against remote attacks, like the other ones? I still wonder about the exposed connector - what its durability. After all, I would like for such a tool to serve me for years fault-free.

Post by r00fus » Tue, May 08, 2018, 7:24 PM UTC

d4l3k wrote: post #26

pishpash wrote: post #23

Earlier quoted context omitted.

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.

Post by [deleted] » Tue, May 08, 2018, 7:31 PM UTC

vzaliva wrote: post #10

Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.